anomaly / anomaly/lab-python-server

Review `traefik` configuration, preferably implement a completely dynamic configuration

オープン
#62 コメント 3 件 リアクション 0 件 担当者 1 名 @devraj が担当を希望しています GitHub で見る
bug documentation
主要言語
Python
スター
16
フォーク
4
PR マージ指標
30日以内にマージされた PR はありません

説明

**Is your feature request related to a problem? Please describe.**
The current `traefik` configuration is a relic from when the team was working on projects and deploying them via `docker-compose` on `Linode` servers.

The first issues as amongst many of the things that I took handovers on is inconsistency. For example here there are various elements configured via the `dynamic` route and then others via the `static` route.

Here's an extract from the current production `docker-compose` file for production:

```labels
- "--providers.docker"
- "--providers.docker.exposedbydefault=false"
- "--providers.file"
- "--providers.file.filename=/opt/traefik/traefik-dynamic.toml"
```

this shows how there are a couple of different ways configurations are being read.

Further there are various security concerns in the configuration:

- `HSTS` headers are missing
- The configuration allows for older versions `TLS` that are known to have security vulnerabilities
- `X-Frame-Options` to be set to `DENY`

**Describe the solution you'd like**
Ideally we want to use a completely `dynamic` configuration based on the `docker` or `kubernetes` [providers](https://doc.traefik.io/traefik/providers/overview/). A dynamic configuration would allow us to use variables which would make the configuration generic for all our projects.

Secondly we need to review the labels associated to the API container. These are a relic from when the team was working on in the applications in 2021.

Properly review the security requirements of modern web applications:
- [HTTP Strict Transport Security](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) (HSTS)
- Support good known versions of TLS

The ultimate aim of the template is to achieve `A+` security rating on any testing platform.

> Note this ticket should be updated once a proper review of security standards has been conducted.

**Reverse proxy considerations**
Our configure should provide reverse proxy configurations:
- For containers e.g API or front end [wrapped in container](https://github.com/anomaly/lab-web-client/issues/17) (accompanying [docs](https://github.com/anomaly/lab-web-client#docker-container-for-production))
- Proxying Object stores for serving front end clients and assets (where scale is a factor)
- Considerations for sitting behind a content distribution network

**HSTS configuration**
Label based configuration for HSTS, as [per this article](https://calvin.me/hsts-with-traefik/) (again this is subject to be reviewed after my research)
```
traefik.frontend.headers.STSSeconds: "31536000"
traefik.frontend.headers.STSIncludeSubdomains: "true"
traefik.frontend.headers.STSPreload: "true"
```

**Describe alternatives you've considered**
None as this is the template that should serve our other applications

**Additional context**
As realised with much of the work that was done in 2021, these configurations are uniformed from a security standpoints and should be abandoned and built from the ground up.

Ultimately we should put the configuration through [SSLlabs](https://www.ssllabs.com/ssltest/index.html) and see it meets the A+ requirements of a modern web application.

コントリビューションガイド

このリポジトリのコントリビューションガイドは索引されていません

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。